Question

我有两个日志文件。

Log1:
Apr 10 02:07:20  Data 1
Apr 11 02:07:20  Data 1
May 10 04:11:09  Data 2
May 12 04:11:09  Data 2

Log 2
[10/04/16 02:07:20  BST] Data 1
[11/04/16 02:07:20  BST] Data 1
[10/05/16 04:11:09  BST] Data 2
[12/05/16 04:11:09  BST] Data 2

我想提取startime和endtime之间指定的数据。我使用以下代码。但它不起作用。

log1="$(awk '/LOG_FILE1/{print $NF}' log.conf)"
log2="$(awk '/LOG_FILE2/{print $NF}' log.conf)"
StartTime="$1 $2 $3"
EndTime="$4 $5 $6"
echo $StartTime
echo $EndTime

if [ $log1=log_1.log ]
then
{
for file in $log1;
do     
echo "$file:";    
sort -t' ' -k1,1M -k2,3n $file | sed -n "/$StartTime/,/$EndTime/p";
done
}
fi

if [ $log2=log_2.log ]
then
{
for file in $log2;
do     
echo "$file:";    
sort -n -k 1.5 -k 1.3 -k 1 $file | sed -n "/$StartTime/,/$EndTime/p";
done
}
fi

我的输入可以是

.filename Apr 10 02:07:20 May 12 04:11:09

或

.filename [10/04/16 02:07:20  BST] [12/05/16 04:11:09  BST]

其中filename是包含上述代码的文件。我没有得到结果，因为日志文件中的数据格式不同？如何修改代码以提取数据？

对于给定的输入，我希望我的输出如下，

 Log1:
Apr 10 02:07:20  Data 1
Apr 11 02:07:20  Data 1
May 10 04:11:09  Data 2
May 12 04:11:09  Data 2
Log 2
[10/04/16 02:07:20  BST] Data 1
[11/04/16 02:07:20  BST] Data 1
[10/05/16 04:11:09  BST] Data 2
[12/05/16 04:11:09  BST] Data 2

对于第一个输入，我得到输出，如

May 10 04:11:09
May 12 04:11:09
log_1.Log:
May 10 04:11:09  Data 2
May 12 04:11:09  Data 
log_2.log:

对于第二个输入，我的输出就像，

[10/04/16 02:07:20 BST]
[12/05/16 04:11:09 BST]
log_1.Log:
Apr 10 02:07:20  Data 1
Apr 11 02:07:20  Data 1
May 10 04:11:09  Data 2
May 12 04:11:09  Data 2
log_2.log:
[10/04/16 02:07:20  BST] Data 1
[11/04/16 02:07:20  BST] Data 1
[10/05/16 04:11:09  BST] Data 2
[12/05/16 04:11:09  BST] Data 2

如何修改以获得确切的结果？

Answer 1

你还没有向我们展示你的预期输出，如果你输出你想要的或不是你想要的东西，那么这就是我想做你想做的事情的方法，使用GNU awk作为时间函数：

$ cat tst.awk
function mthDayTime2secs(mthDayTime,    t, mthNr) {
     split(mthDayTime, t, / /)
     mthNr = (match("JanFebMarAprMayJunJulAugSepOctNovDec",t[1])+2)/3
     return mktime(thisYear" "mthNr" "t[2]" "gensub(/:/," ","g",t[3]))
}

function mthDayYearTime2secs(mthDayYearTime,    t) {
     split(mthDayYearTime, t, /[\/ ]/)
     return mktime(thisCent t[3]" "t[1]" "t[2]" "gensub(/:/," ","g",t[4]))
}

function spec2secs(spec,        secs) {
    if (spec ~ /^\[/) {
        secs = mthDayYearTime2secs(gensub(/.(.{17}).*/,"\\1",1,spec))
    }
    else {
        secs = mthDayTime2secs(gensub(/(.{15}).*/,"\\1",1,spec))
    }
    return secs
}

BEGIN {
    thisYear = strftime("%Y")
    thisCent = gensub(/..$/,"",1,thisYear)
    begSecs = spec2secs(begSpec)
    endSecs = spec2secs(endSpec)
}

{ currSecs = spec2secs($0) }
currSecs >= begSecs && currSecs <= endSecs

$ awk -v begSpec="Apr 10 02:07:20" -v endSpec="May 10 04:11:09" -f tst.awk log1 log2
Apr 10 02:07:20  Data 1
Apr 11 02:07:20  Data 1
May 10 04:11:09  Data 2

$ awk -v begSpec="May 03 02:07:20" -v endSpec="Oct 05 04:11:09" -f tst.awk log1 log2
May 10 04:11:09  Data 2
[10/04/16 02:07:20  BST] Data 1
[10/04/16 09:07:20  BST] Data 1

是否可以从具有两种不同日期格式的日志文件中提取数据？

1 个答案: